Comment by pomfpomfpomf3

An attacker can also replace an https:// login URL with an http:// one on a page sent via unencrypted connection. The http:// page can then be manipulated in any way.